#Scriptcase iframe do not refresh code

But there are two aspects of the change Mike is proposing that lead to useful security benefits:

In general I agree with Boris that the current innerHTML behavior isn't a security feature (because of event handlers, javascript URIs, etc, all of which will execute script as a result of the assignment). I don't think we should be trying to shoehorn security properties in here, because as pointed out above that ends up in a whack-a-mole of stupendous proportions.īut it's far too widely used to consider changing the default behavior

It's a compat feature, and it was introduced solely because people had a tendency to append things by doing body.innerHTML += stuff (which is a bad pattern for all sorts of reasons, of course). In general, the 'do not run script' behavior of innerHTML is not a security feature. Is the intent to turn off scripting entirely for all loads in an inserted via innerHTML? Or to only turn it off for srcdoc loaded in such an iframe? What happens if an is inserted via innerHTML with no attributes and then much later the srcdoc attribute is set? Or the iframe is navigated to some other URL? I don't think this is fundamentally different from being inserted via innerHTML. cc in the hopes that other vendors have opinions. I'm just now adding counters to Chrome, so I don't have any numbers to point to, but my suspicion is that srcdoc usage is low enough to make a change like this both possible and reasonable (and if not by default, then certainly as an opt-in). This would address some attack vectors and team are concerned about in Google properties. We might, for example, set a flag on the HTMLIframeElement, cascade it to frames created in that frame, and read it out when preparing script to determine whether to proceed. Since we more or less treat srcdoc as part of the parent document (and, indeed, it's content is entirely determined by the parent), I'd suggest that it might make sense to cascade the scripting flag into the newly created document. From another perspective, through, it's strange, as that document was created via a fragment where scripting was not enabled. This makes perfect sense from one perspective, as the script is executing in the context of a new document where scripting is enabled.

#Scriptcase iframe do not refresh code

= 'alert(1) ' does not cause code to execute, which is a valuable property for reasons that include a defense against some forms of XSS.ĭ = 'alert(1) '>', on the other hand, does cause code to execute.